CVE-2021-3847
Public on
Last Modified:
Description
An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a file with capabilities from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.
Mitigation
The mitigation is to mount overlayfs with nosuid if lower layer is nosuid.
Additional information
- Bugzilla 2009704: kernel: low-privileged user privileges escalation
- CWE-281: Improper Preservation of Permissions
- FAQ: Frequently asked questions about CVE-2021-3847
Common Vulnerability Scoring System (CVSS) Score Details
Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
| Red Hat | NVD | |
|---|---|---|
CVSS v3 Base Score | 6.7 | 7.8 |
Attack Vector | Local | Local |
Attack Complexity | Low | Low |
Privileges Required | High | Low |
User Interaction | None | None |
Scope | Unchanged | Unchanged |
Confidentiality Impact | High | High |
Integrity Impact | High | High |
Availability Impact | High | High |
CVSS v3 Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
The privileges required High (PR:H), because "mount: only root can use "--options" option" (so regular user cannot run command like "mount -t overlay overlay -o lowerdir=/lower,upperdir=/upper,workdir=/work /merged" if without root or some other root-like privileges). For the case when inserting USB device that this bug about unlikely that auto-mount could happen for OverlayFS too. However, there is other more or less similar CVE-2023-0386 about OverlayFS subsystem where actually PR:L.
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Application Data; Modify Application Data
Acknowledgements
Red Hat would like to thank Alon Zahavi (CyberArk) for reporting this issue.
Frequently Asked Questions
Why is Red Hat's CVSS v3 score or Impact different from other vendors?
My product is listed as "Under investigation" or "Affected", when will Red Hat release a fix for this vulnerability?
What can I do if my product is listed as "Will not fix"?
What can I do if my product is listed as "Fix deferred"?
What is a mitigation?
I have a Red Hat product but it is not in the above list, is it affected?
Why is my security scanner reporting my product as vulnerable to this vulnerability even though my product version is fixed or not affected?
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
